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(57) Abstract: A system and method distribuoute the task of decryp- 
tion between a server and a client. To encrypt ot data, the client gener- 
ates an encryption/decryption key. Namely, a la user interface obtains 
a password, generally from a user. A hint genenerator generates a hint 
A key generator generates the key based on ti the password and the 
hinL In one embodiment, the key generator hahashes the password to 
generate a first secret, hashes the first secret to [O generate a second se- 
cret, hashes the first secret with the hint to genenerate an intermediate 
index, and hashes the second secret and the b intermediate index to 
generate the key. An encryption engine can ththen use the key to en- 
crypt data. The client then sends the encrypted id data and possibly the 
hint for storage on the server. To decrypt the <e data, the key must be 
determined. Accordingly, the server knows sc some information and 
the user knows some information for decryptinting the data. To gener- 
ate the key, the decrypting client must first obobtain rights to retrieve 
the hint from the server and must obtain the pasassword from the user. 
Increased level of security is achieved. 
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SYSTEM AND METHOD FOR ENCRYPTING AND DECRYPTFING FILES 

BACKGROUND OF THE INVENTION 

1. Field of the Invention 

This invention relates generally to computer networks, and morore 
particularly to a system and method for encrypting and decrypting filesss to 
enable secure exchange of information in a computer network. 

2. Background Art 

In its infancy, the Internet provided a research-oriented environmment 
where users and hosts were interested in a free and open exchange of 
information, and where users and hosts mutually trusted one another. HHowever, 
the Internet has grown drastically, currently interconnecting at least 10(00,000 
computer networks and millions of users. Because of its size and opennness, the 
Internet has become a target of data theft, data alteration and other miscschief. 

Virtually everyone that sends information over the Internet is vulnerable. 
Before sending a file, companies balance the benefits and ease of transferring a 
file over the Internet against the risks of potential unauthorized file acctcess. 

One of the most popular of current security techniques is privatete key file 
encryption and decryption. A file may be encrypted and decrypted usining.a 
private key known to all authorized users. Thus, a file may be encrypteted using 
the private key, forwarded over a computer network, and decrypted usising the 
private key by the end user. Accordingly, both the encrypting party anad the 
decrypting party must know the private key. 

This encryption and decryption security technique does not solvere 
problems and concerns of the roaming user. First, for example, a roamining user 
must maintain a portable record of all private keys so that he or she canm decrypt 
or re-encrypt files. Maintaining a portable record can be a time consumming and 
cumbersome process. Therefore, a system and method for encrypting a and 
decrypting files is needed to facilitate remote access to information rescsources in 
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a computer network easily and securely (without sending keys over theie 
network). 



SUMMARY OF THE INVENTION 

The present invention provides a system and method for encryprpting and 
decrypting files to enable secure access to information resources in a c<computer 
network. The system and method distribute the task of decryption betvtween a 
server and a client, thereby adding to the level of security. The system n and 
method provide recognizable benefits in a network having a trusted clidient 
(which performs the encryption), a server (which stores the encrypted d data and 
a hint), and an untrusted client (where the user is currently operating). . 
Decryption may be performed at the server or at the untrusted client, wsvithout 
transferring the key or a password over the network. 

To encrypt data, the trusted client generates an encryption/decryyption 
key. That is, a user interface obtains a password, generally from a userer. A hint 
generator generates a hint, preferably, a pseudo-random number. A kej.ey 
generator generates a key based on the password and on the hint. In a n more 
secure, but more complex, embodiment enabling server-side or client-s-side 
decryption, the key equals H(H(H(P)), H(H(P), hint)). Namely, a key g generator 
hashes the password to generate a first secret, hashes the first secret to p generate 
a second secret, hashes the first secret with the hint to generate an intenrmediate 
index, and hashes the second secret and the intermediate index to geneierate the 
key. In a simpler, but less secure, embodiment facilitating client-side 
decryption, the key equals H(P, hint). Namely, a user interface obtains is a 
password and a hint generator generates a hint. Then, a key generator h hashes 
the password and the hint to generate the key. An encryption engine ca:an then 
use the key to encrypt data. The client sends the encrypted data and theie hint for 
storage on the server. Alternatively, the global server can generate and d store the 
same hint independently. - 
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To decrypt encrypted data, the key must first be determined. TTo 
generate the key, the server knows some information and the user knoows some 
information. For data encrypted using the more secure encryption emhbodiment, 
client-side and server-side decryption are each possible. 

In the client-side decryption case, a user interface obtains the p.password 
from the user. A communications engine retrieves the hint from the seserver. An 
index generator hashes the password to generate the first secret, and hdiashes the 
hint and the first secret to generate the intermediate index. A key geneierator 
hashes the first secret to generate the second secret, and hashes the seccond 
secret and the intermediate index to generate the key. In the server-sidide 
decryption case, the communications engine forwards the intermediatete index to 
the server. The server, which for this embodiment preferably learned & the 
second secret during account setup, hashes the second secret and the 
intermediate index to generate the key. It will be appreciated that, beccause the 
server does not know the password or the first secret (which is only delerivable 
knowing the password), the server alone cannot compute the key. 

For data encrypted using the simpler encryption embodiment, tfthe remote 
client generates the key. A user interface obtains a password from the e user. A 
communications engine retrieves the hint and encrypted data from the e server. 
A key generator hashes the password and the hint to generate the key. v It will be 
appreciated that any number of hashes can be performed on the variabiles to 
compute the key. For example, the password may be hashed to cornpumte a 
secret, and the secret and key may be hashed to compute the key. 

A first system in accordance with the present invention includesss a user 
interface for obtaining a password; a key generator coupled to the usenr interface 
for hashing a hint and the password to generate a key; an encryption erengine 
coupled to the key generator for encrypting data using the key; and a 
communications module coupled to the engine for sending the encryptoted data 
and the hint to a server for storage. 
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A second system in accordance with the present invention incluludes an 
encryption downloadable for deriving an encryption key from a passwword and a 
hint; a web server for interfacing with a client, for sending the encryption 
downloadable to the client, for receiving encrypted data that was enciyypted by 
the encryption downloadable from the client, and for receiving a hint 
corresponding to the encrypted data and needed to regenerate the key f from the 
client; and memory coupled to the web server for storing the hint and t the 
encrypted data. 

A third system in accordance with the present invention includeles a user 
interface for obtaining a password; a communications module for receieiving the 
encrypted data and a hint corresponding to the encrypted from a servers; a key 
generator for hashing the password and the hint to generate a key for ddecrypting 
the encrypted data. 

A fourth system in accordance with the present invention includdes a 
decryption downloadable for deriving a key from a password and a hinmt; 
encrypted data; a hint corresponding to the encrypted data; and a web s server for 
interfacing with a client, and for sending the decryption downloadable^, the 
encrypted data and the hint to the client. 

A fifth system in accordance with the present invention includeses a user 
interface for obtaining a password; an index generator coupled to the uuser 
interface for generating an intermediate index from a hint received fronm a 
server and a secret derived from the password; and a communications e engine 
coupled to the index generator for sending the intermediate index to thdie server. 

A sixth system in accordance with the present invention includeies a 
second secret corresponding to a user; a decryption downloadable for 
generating an intermediate index from a password and a hint; a web seierver for 
receiving an indication of encrypted data to be decrypted, for transmitttting the 
decryption downloadable and a hint corresponding to the indication to o a client, 
and for receiving an intermediate index from the client; and a server-reresident 
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module for deriving a key for decrypting the encrypted data from the s* second 
secret and the intermediate index. 

One of ordinary skill will recognize that the key is never transmmitted 
over computer network. It will be further appreciated that the password is 
never transmitted over the internet. Thus, even if a hacker somehow o obtained 
the password, the hacker could not generate the key without obtaining g the 
proper hash functions and hint corresponding to the data from the servver (which 
requires proper identification and authentication). It will be farther appreciated 
that, for server-side decryption in the more secure embodiment, the sececond 
secret is transmitted only once across the network, preferably, at accoumnt setup. 
The second secret, along with the first secret and the hint, are needed a at a later 
time to generate the key. Thus, it would be practically impossible for z a hacker 
to obtain all the information needed to generate the key. 

It will be even further appreciated that, by distributing parts of ff the 
decryption function to the remote client and parts to the server, it is noiot possible 
for either site alone to decrypt data without acquiring additional infonrmation 
from the other site. One of ordinary skill will understand that by distributing 
the decryption function between the remote client and server (referred d to as 
double indirection), it is not possible for the global server to decrypt tithe file 
without acquiring additional information from the remote client and virice versa. 
Hence, one of ordinary skill will understand that an unauthorized captvture of 
information during network transfer will fail to provide enough informmation to 
decrypt encrypted data. Therefore, the system and method provide a ^heightened 
level of data security. 

BRIEF DESCRIPTION OF THE DRAWINGS 
FIG. 1 is a block diagram illustrating a roaming-user network acaccess 
system in accordance with the present invention; 

FIG. 2 is a block diagram illustrating details of an example commputer; 
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FIG. 3 is a block diagram illustrating details of the encryption i 
downloadable of FIG. 1; 

FIG. 4 is a block diagram illustrating details of the client decryjyption 
downloadable of FIG. 1; 

FIG. 5 is a block diagram illustrating details of the server deciyyption 

module of FIG. 1; 

FIG. 6 is a flowchart illustrating a method of file encryption in n 
accordance with the present invention; 

FIG. 7 is a flowchart illustrating details of key generation and u use in 
accordance with FIG. 6; 

FIG. 8 is a flowchart illustrating a method of decrypting a file i: in 
accordance with the present invention; 

FIG. 9 is a flowchart illustrating details of server decryption in a 
accordance with FIG. 8; 

FIG. 10 is a flowchart illustrating additional details of server ddecryption 
in accordance with FIG. 9; 

FIG. 1 1 is a flowchart illustrating details of remote client decryption in 
accordance with FIG. 8; 

FIG. 12 is a flowchart illustrating another method of encryptingig data; 

and 

FIG. 13 is a flowchart illustrating another method of decryptingig data. 
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DETAILED DESCRIPTION 

The following description illustrates general and specific principiples of 
the invention and is not to be considered limiting. 

FIG. 1 is a block diagram illustrating an exemplary network sys/stem 100 
for encrypting and decrypting data, in accordance with the present inve/ention. 
Network system 100 comprises a global server 105 coupled via compiuuter 
network 1 10 to a local client 1 15 and to a remote client 120. The compputer 
network 1 10 may include or be a part of the wide area network commoionly 
referred to as the Internet. The global server 105 may be protected by v a global 
firewall (not shown), and the local client 1 15 and remote client 120 maiay each 
be protected by a client firewall (not shown). 

The global server 105 includes a computer system that has an encryption 
downloadable 123, a client decryption downloadable 125, a server decicryption 
module 130, a user database 135 and a web server 175. The user datahbase 135 
includes encrypted data 140, hints 145 and second secrets 150. It will II be 
appreciated that global server 105 may also include security services (n(not 
shown) for performing identification and authentication services to conmfirm 
user access privileges. 

For the invention herein, a Downloadable is executable or interprpretable 
application code, which is downloaded from a source computer and rutin on a 
destination computer. Further, the term "executable" includes "interproretable 
A Downloadable is typically requested and executed by an ongoing prcrocess 
such as by an Internet browser or web client. Examples of Downloadalables 
include Java™ applets designed for use in the Java™ distributing envirironment 
developed by Sun Microsystems, Inc., JavaScript™ scripts also developped by 
Sun Microsystems, Inc., ActiveX™ controls designed for use in the AcctiveX™ 
distributing environment developed by the Microsoft Corporation, Visisual Basic 
also developed by the Microsoft Corporation and HTML. Downloadahbles may 
also include plugins, which add to the functionality of an already existiting 
application program. It will be appreciated that each Downloadable maiay 
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include one or more applets, one or more ActiveX controls, one or maore 
plugins, etc. or combinations thereof. Although preferable, it will be t further 
appreciated that the Downloadable need not be deleted upon logoff. 

The local client 115 includes a computer system that has a browser 165 
and unencrypted data 170. The remote client 120 includes a computerer system 
that has a browser 1 55 and a data program 1 60 for viewing the unenccrypted (or 
decrypted) data 1 70. The local client 1 1 5 may be a "trusted" client, annd the 
remote client 120 may be an "untrusted" client. It will be appreciated d that the 
difference between the remote client 120 and the local client 1 15 is nwierely that 
the user operates the local client 1 15 to encrypt data 170 and the user c operates 
the remote client 120 to request decryption of the data 140. The remoiote client 
120 and local client 115 may be the same computer. The term "brows'ser" is 
being used herein to include any engine for communicating in a netwaork 
environment, possibly using File Transfer Protocol (FTP), HyperText t Transfer 
Protocol (HTTP) and HyperText Markup Language (HTML). It will t be 
appreciated that local client 1 15 or remote client 120 may include a sirmart 
telephone, a Personal Data Assistant (PDA) such as the Palm III™ sys/stem by 
the U.S. Robotics, Inc., a laptop computer, etc. Although not shown, c, one 
skilled in the art will recognize that the local client 115 may also inclu.ude an 
instance of the data program 160. Those skilled in the art will recogniiize that 
the data program 160 may be a data processing program, an e-mail prcrogram, a 
network browser, a calendar program or another type of processing en;ngine. 
Accordingly, the unencrypted data 170 may include files, e-mail, boolokmarks, 
calendar information or other type of data. 

The encryption downloadable 123 enables the local client 1 15 t- to encrypt 
the unencrypted data 170 and to store the encrypted data 140 on the glglobal 
server 105. A first method of encryption is discussed with reference tcto FIGs. 6 
and 7. Generally, the encryption downloadable 123 generates two secicrets from 
a password and selects a random number hint 145. The encryption 
downloadable 123 then hashes the hint and the first secret to generate s an 
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intermediate index. The encryption downloadable 123 then hashes theie index 
and the second secret to generate the key, which is used to encrypt the e data 170. 
The encryption downloadable 123 then sends the encrypted data 140 amnd the 
hint 145 to the global server 105. Alternatively, the encryption downldoadable 
123 can send the encrypted data 140 to the global server 105, and the g global 
server 105 can generate and store the same hint 145 independently. It 1 will be 
appreciated that a hash function provides a non-reversible calculation a of result 
that prevents derivation of the original values. It will be appreciated ththat an 
embodiment where the server generates the hint, computes the key froiom the 
secrets and encrypts the data is also possible, and easily understood by y one 
skilled in the art from the teachings herein. It will be further appreciatated that 
file encryption could be performed by the global server 105. For.exammple, the 
unencrypted data 170 could be uploaded to the global server 105 via a a secure 
transmission line and encrypted at the global server 105. 

Accordingly, to decrypt the encrypted data 140, the hint 145 anad two 
secrets associated with the encrypted data 140 must be determined To'o enable 
client-side decryption of encrypted data 140, the encryption downloadable 123 
stores the hint 145 on the global server 105. To enable server-side decryption 
of the encrypted data 140, the encryption downloadable 123 stores the b hint 145 
and the second secret 1 50 on the global server 115. These two methodds of 
decryption are described with reference to FIGs. 8-11. 

Other techniques of encryption and decryption, which allow a clclient site 
1 15/120 to maintain some information and the server 105 to maintain o other 
information for decrypting data 140, are also possible in light of the teaeachings 
herein. For example, in a simpler but less secure embodiment that facilitates 
client-side decryption (described in greater detail with reference to FIGGs. 12 
and 13), the key equals H(P, hint). Generally, a key generator hashes a a 
password and a hint to generate the key. The hint is stored on the glob±>al server 
and the password is known by the user. Accordingly, for decryption, t\two-site 
responsibility is still needed to generate the key. 
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The client decryption downloadable 125 performs client-side ddecryption, 
and is described with reference to FIGs. 8 and 1 1 . Generally, the clienint 
decryption downloadable 125 requests the password from the user on t the 
remote client 120 and uses the same hashing function to generate the t\two 
secrets. Using the secrets and the hint (downloaded from the global seierver 
105), the decryption downloadable 125 uses the same hashing algorittohm as the 
encryption downloadable 123 to generate the same key. The decryptio.on 
downloadable 125 then uses the key to decrypt the encrypted file 140. . 

The server decryption module 130 performs server-side decryptition, and 
is described with reference to FIGs. 8-10. Generally, the server decryption 
module 130 sends a downloadable (server,decryption downloadable 5005, FIG. 
5) and the hint 145 associated with the encrypted file 140 to the client 1 120. The 
decryption downloadable 505 is described in detail with reference to FFIG. 5. 
The downloadable requests the password from the user and uses the saiame 
hashing algorithm as the encryption downloadable to generate the first ;t secret. 
The downloadable then uses the first secret and the hint 123 in the samcne 
hashing algorithm as the encryption downloadable to generate the intermediate 
index. The downloadable then sends the index to the server decryptionm module 
130, which uses the intermediate index and the second secret 150 to ge;enerate 
the key. 

It will be appreciated that the second secret may have been storered on the 
global server 105 during the setup of the original account. That is, at a< account 
setup, a downloadable having secret generation code may have been se;ent to the 
user, for example, at the local client 115, who inputs a password. The ; 
downloadable then generates the second secret i 50 and forwards the sesecond 
secret 1 50 to the global server 105. It will be appreciated that the secoiond secret 
1 50 alone is not enough to generate the key, since the intermediate inddex is not 
known. It will be appreciated that, for this embodiment, server-side or >r client- 
side decryption could be selected based on the security level of the 
communication channel between the client 120 and server 105, on clierent 
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terminal type (e.g., processor power), on the size of the file (e.g., the I length of 
time it will take to download the file), or on user preferences. Furthers, server- 
side or client-side decryption can be determined at the time of decryption, at the 
time of encryption, at account setup, or at any other time. 

The web server 114 provides web page data and web page fimcictionality 
to clients, such as to the remote client 1 16 or to the local client 124. P Providing 
web page functionality and data may include transmitting downloadahbles such 
as the encryption downloadable 123 and the client decryption downloadable 
125 to the clients. 

FIG. 2 is a block diagram illustrating a computer system 200 wwhich 
illustrates details of each of the global server 105, the local client 1 15 5 and the 
remote client 120. The computer system 200 includes a processor 205)5, such as 
an Intel Pentium® microprocessor or a Motorola Power PC® microprocessor, 
coupled to a communications channel 220. The computer system 200 0 farther 
includes an input device 210 such as a keyboard and mouse, an outputit device 
215 such as a Cathode Ray Tube (CRT) display, a communications dele vice 225, 
data storage 230 such as a magnetic disk, and working memory 235 siBUch as 
Random- Access Memory (RAM), each coupled to the communicationms channel 
220. The communications channel 220 may be coupled to a computers network 
110. One skilled in the art will recognize that, although the data storajage 230 
and working memory 235 are illustrated as separate units, data storagqe 230 and 
working memory can be integrated or partially integrated units. 

An operating system 240 controls processing by the processor 2 205, and 
is typically stored in data storage 230 and loaded into working memonry 235 (as 
illustrated) for execution. Other programs and data 245 such as brows/sers, 
servers, downloadables, unencrypted or encrypted data, etc. may also b be stored 
in data storage 230 and loaded into working memory 235 (as illustrateced) for 
execution by processor 205. 

One skilled in the art will recognize that the computer system 2 200 may 
also include additional information, such as network connections, addiditional 
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memory, additional processors, LANs, input/output lines for transferrrring 
information across a hardware channel, the Internet or an Intranet, etc:c. One 
skilled in the art will also recognize that the programs and data may b±>e received 
by and stored in the system in alternative ways. For example, a compiputer- 
readable storage medium (CRSM) reader 250 such as a floppy disk dririve, hard 
disk drive, CD-ROM reader, magneto-optical reader, CPU (for RAM)!), etc. may 
be coupled to the communications channel 220 for reading a computeier-readable 
storage medium (CRSM) 255 such as a magnetic disk, a hard disk, a n magneto- 
optical disk, RAM, etc. Accordingly, the computer system 200 may rereceive 
programs and data via the CRSM reader 250. 

FIG. 3 is a block diagram illustrating details of the encryption 
downloadable 123. The encryption downloadable 123 includes a userrr interface 
305, a key generator 310, an encryption engine 315, a global server 
communications engine 320 and a hint generator 325. The user interfzface 305 
includes code for causing a computer to present information to and recpquest 
information from the user. For example, the user interface 305 requeststs 
identification and authentication information, and a password and idercntification 
of the unencrypted data 170 desired to be encrypted. The key generatctor 3 1 0 
includes code for generating a key for encrypting data 170. As describibed 
above, the key generator 310 performs an algorithm of generating firstst and 
second secrets from a password, hashing the first secret and the hint 1445 to 
generate an intermediate index, and hashing the second secret and the 5 
intermediate index to generate the key. During the key generation proocess, the 
key generator 310 requests the hint generator 325 to generate a randomrn number, 
preferably of variable length, to be the hint 145. The encryption enginoie 315 
includes code for using the key and an encryption algorithm, e.g., syrmnmetric 
algorithms. DES, triple DES, BlowFish, RC-5, etc., to encrypt the unerencrypted 
file 170. The global server communications engine 320 includes any c code 
needed for communicating with the global server 105, e.g., for sendingg the hint 
145 and the encrypted file 140 and, if necessary, the second secret 150.0, to the 
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global server 105. It will be appreciated that the global server 105 majay include 
a hint generator (not shown) to generate the same hint as generated by y the hint 
generator 325. Accordingly, the local client 115 need not forward the e hint to 
the global server 105. A method of encrypting data is described in detetail with 
reference to FIGs. 6 and 7. 

It will be appreciated that, for client-side decryption, the systemm may 
alternatively not generate a secret at all. Alternatively, the system mayiy perform 
any number of hashes of the variable password and variable hint. For r example, 
the key generator 310 may hash the password and the hint to generate e the key. 
When a request is received for client-side decryption, the client decryption 
downloadable and hint may be transmitted to the remote client 120. TJThe client 
decryption downloadable can request the password, and hash the hint z and 
password to generate the key. A hacker obtaining the transmitted hint it has 
insufficient information to generate the key. Two secrets are generateced for 
server-side decryption since the hint and intermediate index must be trtransmitted 
across the network 1 10. A second level of indirection is therefore neeeded. In 
either case, the task of decryption is distributed between the global senrver 105 
and remote client 120, and the key is never transmitted across the netwwork 1 10. 

FIG. 4 is a block diagram illustrating details of the client decryption 
downloadable 125. The client decryption downloadable 125 includes s a user 
interface 405, a key generator 410, a decryption engine 415 and a globibal server 
communications engine 420. The user interface 405 is similar to the u:user 
interface of the encryption downloadable 123, and includes code needded for 
causing a computer to present information and request information froiom a user. 
For example, the user interface 405 requests identification and authentication 
information, a password and identification of the encrypted data 140 tcto be 
decrypted. The key generator 410 includes code for generating the ke^y using 
the same algorithm as the key generator 3 10 of the encryption downloadable 
123. That is, preferably, the key generator 410 uses the password to generate 
the first and second secrets, hashes the hint and first secret to generate e the 
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intermediate index, and hashes the second secret and the intermediate i index to 
generate the key. Lastly, the decryption engine 415 includes code for v using the 
key and a decryption algorithm, e.g., symmetric algorithms, DES, triplole DES, 
BlowFish, RC-5, etc., which is associated with the encryption algorithihm used 
by the encryption engine 3 15 of the encryption downloadable 123, to d decrypt 
the encrypted data 140. The global server communications engine 420.0 includes 
any code needed to communicate with the global server 105 to receive e hints 
145 and encrypted data 140. A method of decryption is described in ddetail with 
reference to FIGs. 8-11. 

FIG. 5 is a block diagram illustrating details of the server decryption 
module 130. The server decryption module 130 includes a server decnryption 
downloadable 505 and a server resident module 510. The server decryption 
downloadable 505 includes a user interface 515, an index generator 52'20 and a 
global server communications engine 525. The server resident modulele 510 
includes a key generator 530, a decryption engine 535 and a remote cliJient 
communications engine 540. The user interface 525 is similar to the uaiser 
interface 305 of the encryption downloadable 123 and to the user intertrface 405 
of the client decryption downloadable 125. The user interface 515 inclcludes 
code for presenting information to and requesting information from theie user, 
such as identification and authentication information, a password and 
identification of encrypted data 140 to be decrypted. The index generarator 520 
preferably includes code for using the password to generate the first se<ecret, and 
for hashing the first secret and the hint to generate the intermediate indidex. The 
global server communications engine 525 includes code for communicicating 
with the global server 105, e.g., for receiving hints 145 and decrypted d data from 
the global server 105 and sending the intermediate index to the global A server 
105. 

The key generator 530 preferably includes code for hashing the e 
intermediate index and the second secret 150 previously stored on the p global 
server 105 to generate the key. It will be appreciated that the second scsecret 150 

in 
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may have been received at account creation, during a previous transaction or, if 
necessary, during this transaction. The decryption engine 535 is similalar to the 
decryption engine 415 of the client decryption downloadable 125, andd includes 
code for using the key and the decryption algorithm associated with thdie 
encryption algorithm performed by the encryption engine 315 to decryrypt the 
encrypted data 140. The remote client communications engine 540 incncludes 
any necessary code for sending the decrypted data to the remote client it 1 20, if so 
requested. 

FIG. 6 is a flowchart illustrating a method 600 of encrypting datata 170 in 
network system 100. Method 500 begins by the local client 1 15 in stepep 610 
requesting storage of data 170 on the global server 105. Step 610 mayiy include 
contacting the global server 105 by its URL and selecting the data stonrage 
option from its web page. The web server 175 presenting the web pag*ge may 
farther request identification of the data 170 on the local client 1 15 to b be 
encrypted and stored. The global server 105 in step 620 sends the encicryption 
downloadable 123 to the local client 115. Alternatively, the encryptions 
downloadable 123 may be a permanently installed component, stored c on the 
local client 115 via, for example, a floppy drive or an internet link. 

The local client 1 15 in step 630 executes the encryption downloadable 
123, possibly using the applet-enabled browser 165, installation software 
initiated automatically, ActiveX™ controls, etc., to encrypt data 170. 1 Details of 
step 630 are described with reference to FIG. 7. The local client 1 15 iiin step 
640 sends the encrypted data 140 and the hint 145 corresponding to thdie 
encrypted data 140 to the global server 105. It will be appreciated thatat, for 
global server decryption, the local client 1 1 5 in step 640 may also sendid the 
second secret 150 associated with the user's password to the global sererver 105. 
However, preferably, the second secret 150 has been previously stored d on the 
global server 105 before initiation of this current request, such as at aciccount 
setup. Method 600 then ends. 
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FIG. 7 is a flowchart illustrating details of step 630 as a methood 700 of 
encrypting data 170. Method 700 begins with the user interface 305 oof the 
encryption downloadable 123 in step 710 requesting the password fronm the user 
pr, alternatively, from another computer or subroutine. It will be appreciated 
that the password chosen will not be transmitted over the computer neietwork 
1 10, thereby increasing the level of security. The key generator 310 otof the 1 
encryption downloadable 123 in step 715 performs a one-way hash of f the 
password to generate a first secret, and in step 720 performs a one-wa^y hash of 
the first secret to generate a second secret 150. It will be appreciated f that any 
two secrets can be used, however, two nested hashes of a password prcrovides the 
best mode known for generating secrets and minimizing the data needded by a 
user. One of ordinary skill in the art will understand that each one wa^y hash 
function provides a non-reversible calculation that prevents derivation n of the 
original password or input value or values. 

The key generator 310 of the encryption downloadable 123 in sistep 725 
instructs the hint generator 325 to generate a hint. The hint generator s 325 
generates a cryptographically semi-random number, preferably of variriable 
length, and forwards the number to the key generator 310 as the hint. r The key 
generator 3 10 in step 730 performs a one-way hash using the hint and i the first 
secret to generate an intermediate index. The key generator 310 in stepp 735 
performs a one-way hash function using the intermediate index and theie second 
secret to generate the key. Accordingly, the encryption engine 315 in a step 740 
encrypts the unencrypted data using the key. Method 630 then ends. 

FIG. 8 is a flowchart illustrating a method 800 of decrypting enaicrypted 
data 140, in accordance with the present invention. Method 800 beginais with 
the browser 155 on the remote client 120 in step 810 requesting access;s to the 
encrypted data 140. It will be appreciated that remote client 116 may c only 
request a portion of encrypted data 140. In step 820, a determination is is made 
whether to perform client-side or server-side decryption. This determinination is 
preferably made by the original user setting a preference at account setttup or at 

1^ 
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the time the encrypted data 140 being requested was placed on the globbal server 
105. 

If server-side decryption is selected, then the global server 105 5 in step 
830 executes the decryption algorithm, described in greater detail withth 
reference to FIGs. 9 and 10. Method 800 then proceeds to step 840. Mf client- 
side decryption was selected, then the global server 105 in step 850 seiends the 
client decryption downloadable 125, hint 145 and encrypted data to thdie remote 
client 120. The browser 155 in step 860 executes the client decryptionm 
downloadable 125. Method 800 then proceeds to step 840. 

Then, in step 840, the remote client 120 can, for example, accesss the 
decrypted data. In another example, the remote client 120 in step 840 0 can 
attach the data to an e-mail and transmit the e-mail to another person. . In yet 
another example, the remote client 120 in step 840 can encrypt the datata using 
another person's key, attach the data to an e-mail and transmit the e-maiail to 
another person. It will be appreciated that, in either case where an e-nmail is 
being sent, the global server 105 need not download the decrypted datata since 
the remote client 120 merely transmitting the e-mail and data to anotheier person. 
The global server 105 can perform these steps on behalf of the remote e client 
120. Method 800 then ends. 

FIG. 9 is a flowchart illustrating step 830 in greater detail as a n method 
830 of server decryption. Method 830 begins with the global server 1(105 in step 
910 sending to the remote client 120 the server decryption downloadable 505 
and hint 145 corresponding to the data selected. The remote client 12(10 in step 
920 executes the server decryption downloadable 505 to generate and i send the 
intermediate index to the global server 105, described in greater detail 1 with 
reference to FIG. 10. The key generator 530 of the server resident moodule 510 
on the global server 105 in step 930 performs a one-way hash function n of the 
second secret 1 50 corresponding to the user of the remote client 120 aiand the 
intermediate index to generate the key. It will be appreciated that step p 930 may 
include multiple hashes of the second secret, hints and index to generatate the 
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key. In the preferred embodiment, step 930 is more than concatenation of the 
second secret and intermediate index. Step 930 may conform to PKCSS 
standards or HMAC standards. The decryption engine 535 of the servever 
resident module 5 10 on the global server 105 in step 940 uses the key tr to 
decrypt the requested encrypted data 140. In step 950, the global seiwer 105 
can, for example, send the decrypted data to the remote client 120 or 
alternatively enable the remote client 120 to perform some action on oor 
manipulation of the decrypted data. Method 830 then ends. 

FIG. 10 is a flowchart illustrating step 920 in greater detail, as a a method 
920. Method 920 begins with the index generator 520 of the server decryption 
downloadable 505 in step 1010 requesting the password from the user r of the 
remote client 120. The index generator 520 in step 1020 performs a orone-way 
hash function of the password to compute the first secret, and in step M 030 
performs a one-way hash function of the first secret and hint 145 to geienerate the 
intermediate index. The global server communications engine 525 of tf the server 
decryption downloadable 505 sends the index to the remote client 
communications engine 540 of the server resident module 510 on the g global 
server 105. Method 920 then ends. 

FIG. 1 1 is a flowchart illustrating step 860 in greater detail, as a a method 
860. Method 860 begins the key generator 405 of the client decryptionm 
downloadable 125 in step 1110 requesting the password from the user r of the 
remote client 120. The key generator 405 in step 1 120 performs a one-e-way 
hash function of the password to generate the first secret, and in step 1 11 130 
performs a one-way hash function of the first secret to generate the sectcond 
secret. The key generator 410 in step 1 140 performs a one-way hash fifunction 
of the first secret and the hint 145 to generate the intermediate index, aiand in 
step 1 150 performs a one-way hash function of the second secret and tithe 
intermediate index to generate the key. The decryption engine 415 of t: the client 
decryption downloadable 425 in step 1 160 uses the key to decrypt the e encrypted 
data 140. Method 860 then ends. 
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One of ordinary skill will recognize that the key is never transremitted 
over computer network. It will be further appreciated that the passwc/ord is 
never transmitted over the internet. Accordingly, the key cannot be generated. 
Even if a hacker somehow obtained the password, the key could not b<be 
generated without obtaining the proper hash functions and hint correspsponding 
to the data from the global server 105 (which requires proper identification and 
authentication). It will be further appreciated that the second secret 1350 is 
transmitted only once across the network 1 10, and needed at the time t the data is 
to be decrypted. 

It will be even further appreciated that, by distributing parts of f the 
decryption function to the remote client 120 and parts to the global sererver 105, 
it is not possible for either site alone to decrypt data without acquiring g 
additional information from the other site. One of ordinary skill will 
understand that by distributing the decryption function between the renmote 
client and global server (referred to as double indirection), it is not pos>ssible for 
the global server to decrypt the file without acquiring additional infonrmation 
from the remote client. Hence, one of ordinary skill will understand ththat an 
unauthorized capture of information during network transfer will fail t< to provide 
enough information to decrypt encrypted data 140. Therefore, the syststem and 
method provide a heightened level of data security. 

FIG. 12 is a flowchart illustrating a simple encryption method 1 1200, in 
accordance with the present invention. Method 1200 begins with the u user 
interface 305 in step 1205 requesting a password. The hint generator 3 325 in 
step 1210 generates a hint. The key generator 310 in step 1215 hashes :s the hint 
and the password to generate the key. The encryption engine 315 in st6tep 1220 
uses the key to encrypt data. Method 1200 then ends. 

FIG. 13 is a flowchart illustrating a simple decryption method 1.1300 for 
decrypting data encrypted using encryption method 1200. Method 13O00 begins 
with the remote client 120 in step 1305 requesting access to encrypted d data 140 
stored on the server 105. The server 105 in step 1310 sends the encryppted data 
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140, the corresponding hint 145 and at least a portion of the client decrcryption 
downloadable 125 to the remote client 120. The remote client 120 in s step 1315 
executes the decryption downloadable 125. The user interface 405 in a step 1320 
requests the password from the user. The key generator 410 in step 13:325 
hashes the password and the hint to generate the key. The decryption e engine 
41 5 in step 1330 uses the key to decrypt the encrypted data 140. Metbhod 1300 
then ends. 

The foregoing description of the preferred embodiments of the p present 
invention is by way of example only, and other variations and modifications of 
the above-described embodiments and methods are possible in light of >f the 
foregoing teaching. Although the network sites are being described as is separate 
and distinct sites, one skilled in the art will recognize that these sites mmay be a 
part of an integral site, may each include portions of multiple sites, or r may 
include combinations of single and multiple sites. Further, components of this 
invention maybe implemented using a programmed general purpose didigital 
computer, using application specific integrated circuits, or using a netvtwork of 
interconnected conventional components and circuits. Connections maiay be 
wired, wireless, modem, etc. The embodiments described herein are naiot 
intended to be exhaustive or limiting. The present invention is limited d only by 
the following claims. 
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WHAT IS CLAIMED IS: 

1 1 . A method, comprising: 

2 obtaining a hint; 

3 obtaining a password; 

4 performing a hashing algorithm on the hint and the password to:o generate 

5 a key; 

6 encrypting data using the key; and 

7 sending the encrypted data to a server for storage. 

1 2. The method of claim 1, wherein the step of performing a hashiring 

2 algorithm includes hashing the password. 

1 3. The method of claim 1, 

2 wherein the step of performing a hashing algorithm includes hasashing the 

3 password to derive a first secret, hashing the first secret to derive a sectcond 

4 secret, hashing the hint and the first secret to generate an intermediate b index, 

5 and hashing the intermediate index and the second secret to generate ththe key. 

1 4. A system, comprising: 

2 a user interface for obtaining a password; 

3 a key generator coupled to the user interface for performing a hdiashing 

4 algorithm on a hint and the password to generate a key; 

5 an encryption engine coupled to the key generator for encryptinpg data 

6 using the key; and 

7 a communications module coupled to the engine for sending theie 

8 encrypted data to a server for storage. 

1 5 . The system of claim 4, further comprising a hint generator for ^generating 

2 the hint. 
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1 6. The system of claim 4, wherein the key generator hashes the password. 

1 7. The system of claim 4, wherein the key generator hashes the password to 

2 derive a first secret, hashes the first secret to derive a second secret, haiashes the 

3 hint and the first secret to generate an intermediate index, and hashes tl the 

4 intermediate index and the second secret to generate the key. 

1 8. A system, comprising: 

2 means for obtaining a hint; 

3 means for obtaining a password; 

4 means for performing a hashing algorithm on the hint and the ppassword 

5 to generate a key; 

6 ^ means for encrypting data using the key; and 

7 means for sending the encrypted data to a server for storage. 

1 9. The system of claim 8, wherein the system includes code stored d on a 

2 computer-readable storage medium. 

1 10. The system of claim 8, wherein the system includes code emboddied in a 

2 carrier wave. 
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1 11. A method, comprising: 

2 receiving a request to store encrypted data from a client; 

3 sending an encryption downloadable for deriving a key to encrjrypt data to 

4 the client; 

5 receiving encrypted data that was encrypted by the encryption 

6 downloadable from the client; and 

7 obtaining a hint, corresponding to the encrypted data and needeled for 

8 regenerating the key; and 

9 storing the hint and the encrypted data. 

1 12. A system, comprising: 

2 an encryption downloadable for deriving an encryption key froiom a 

3 password and a hint; 

4 a web server for interfacing with a client, for sending the encryjyption 

5 downloadable to the client, and for receiving encrypted data that was e encrypted 

6 by the encryption downloadable from the client; and 

7 memory coupled to the web server for storing a hint corresponding to the 

8 encrypted data and needed to regenerate the key from the client and thche 

9 encrypted data. 

1 Client-side decryption 

2 13. A method, comprising: 

3 obtaining a password; 

4 receiving encrypted data and a hint corresponding to the encrypted data 

5 from a server; and 

6 performing a hashing algorithm on the password and the hint toto generate 

7 a key for decrypting the encrypted data. 



1 

2 



14. The method of claim 13, wherein the step of performing a hashihing 
algorithm includes hashing the password, 
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1 15. A system, comprising: 

2 a user interface for obtaining a password; 

3 a communications module for receiving the encrypted data and d a hint 

4 corresponding to the encrypted data from a server; 

5 a key generator for performing a hashing algorithm on the pass^sword and 

6 the hint to generate a key for decrypting the encrypted data. 

1 16. A system, comprising: 

2 means for obtaining a password; 

3 means for receiving encrypted data and a hint corresponding to o the 

4 encrypted data from a server; and 

5 means for performing a hashing algorithm on the password and d the hint 

6 to generate a key for decrypting the encrypted data. 

1 17. The system of claim 16, wherein the system includes code storered on a 

2 computer-readable storage medium. 

1 18. The system of claim 16, wherein the system includes code embcbodied in a 

2 carrier wave. 



1 19. A method, comprising: 

2 receiving identification of encrypted data; 

3 sending a decryption downloadable for deriving a key from a password 

4 and a hint to a client; and 

5 sending a hint corresponding to the encrypted data to the client, t. 
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1 20. A system, comprising: 

2 a decryption downloadable for deriving a key from a passwordd and a 

3 hint; 

4 encrypted data; 

5 a hint corresponding to the encrypted data; and 

6 a web server for interfacing with a client, and for sending the d decryption 

7 downloadable, the encrypted data and the hint to the client. 



1 Server-side decryption 



-2 21. A client-based method, comprising: 

3 obtaining a password; 

4 deriving a first secret from the password; 

5 receiving a hint corresponding to data to be decrypted from a s< server; 

6 deriving an intermediate index from the first secret and the hintnt; and 

7 sending the intermediate index to the server. 



1 22 . The method of claim 2 1 , wherein deriving the first secret incluoides 

2 hashing the password. 
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1 23. The method of claim 2 1 , wherein deriving an intermediate indeiex 

2 includes hashing the first secret and the hint. 



1 24. A system, comprising: 

2 a user interface for obtaining a password; 

3 an index generator coupled to the user interface for generating q an 

4 intermediate index from a hint received from a server and a secret deririved from 

5 the password; and 

6 a communications engine coupled to the index generator for sercnding the 



7 intermediate index to the server. 

1 25. The system of claim 24, wherein the index generator generate tithe 

2 intermediate index by hashing the hint and the secret. 

1 26. A system, comprising: 



2 means for obtaining a password; 

3 means for deriving a first secret from the password; 

4 means for receiving a hint corresponding to data to be decrypteced from a 

5 server; 

6 means for deriving an intermediate index from the first secret aiand the 

7 hint; and 

8 means for sending the intermediate index to the server. 

1 27. The system of claim 26, wherein the system includes code storered on a 

2 computer-readable storage medium. 

1 28. The system of claim 26, wherein the system includes code emboodied in a 

2 carrier wave. 



WO 01/13572 PCT/r/US00/22812 

1 29. A server-based method, comprising: 

2 receiving an indication of encrypted data to be decrypted; 

3 transmitting to a client a hint corresponding to the indication, aiand a 

4 decryption downloadable for deriving an intermediate index from a pa<assword 

5 and the hint; 

6 receiving the intermediate, index from the client; and 

7 deriving a decryption key from a second secret corresponding tcto the user 

8 and the intermediate index. 



1 30. A system, comprising: 

2 a second secret corresponding to a user; 

3 a decryption downloadable for generating an intermediate indexsx from a 

4 password and a hint; 

5 a web server for receiving an indication of encrypted data to be e 

6 decrypted, for transmitting the decryption downloadable and a hint 

7 corresponding to the indication to a client, and for receiving an intermeiediate 

8 index from the client; and 

9 a server-resident module for deriving a key for decrypting the erencrypted 
10 data from the second secret and the intermediate index. 
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